Abstract:Host-based intrusion detection systems (HIDS) have been widely acknowledged as an effective approach for detecting and mitigating malicious activities. Among various data sources utilized in HIDS, system call traces have gained significant popularity due to their inherent advantage of providing fine-grained information. Nevertheless, conventional feature extraction techniques relying on system calls tend to overlook the issue of high-dimensional sparse feature space. In this paper, we conduct a theoretical analysis to investigate the underlying causes of the sparsity problem. Subsequently, we propose an anti-sparse theory (anti-ST) as a solution to address this issue. Then, we design a multi-granularity feature extraction method (MGFE), which also meets the prerequisite mathematical conditions of the anti-ST. By applying this method, we effectively reduce the size of the feature space and minimize the number of generated features, thus mitigating sparsity. Furthermore, leveraging this approach, we propose a robust and anti-sparsity host intrusion detection framework, known as the MGFE-based Host Intrusion Detection Framework (BR-HIDF). A series of experiments were conducted to evaluate the proposed framework and compare it with the state-of-the-art method. The results demonstrate that our framework achieves impressive accuracy (97.26%), precision (97.62%), recall (96.85%), and F1 score (97.23%) in the intrusion detection task, surpassing existing frameworks. Moreover, the proposed framework significantly reduces the time overhead by 38.80%, exhibiting the highest AUC value of 0.992. Furthermore, we enhance the robustness of the detection system by integrating host-based and network-based detection, which provides greater flexibility in identifying various types of attacks.

Host risk evaluation framework based on multi-source information

Analyzing host security using D‐S evidence theory and multisource information fusion

Discovering Host Anomalies in Multi-source Information

Security Evaluation Method Based on Host Resource Availability

Improved Evidence Fusion Theory for the Safety Assessment of Prestressed Concrete Bridges

Network security analysis using information fusion

Security Evaluation Of Hosts Based On Network Traffic

Enhancing host security using external environment sensors

Multiple behavior information fusion based quantitative threat evaluation

A Quantitative Risk Assessment Approach for Host System Security

Approach to Security Evaluation Based on Rough Set Theory for Host Computer

Framework for Risk Assessment in Cyber Situational Awareness

BR-HIDF: An Anti-Sparsity and Effective Host Intrusion Detection Framework Based on Multi-Granularity Feature Extraction

Quantitative Risk Assessment Approach for Host Software System Based on Network Scanning

Cluster-based information fusion for probabilistic risk analysis in complex projects under uncertainty

A Fusion Model for Network Threat Identification and Risk Assessment

Security Evaluation Method Based on Real Time Traffic of Hosts

Research on security risk assessment mechanism of important event based on multi-source data

Multisource information fusion for safety risk assessment in complex projects considering dependence and uncertainty

A Deep Belief Network Based Machine Learning System for Risky Host Detection

The Comprehensive Evaluation Method for Organizing Information Security Risk based on Fuzzy Multi-criteria Fusion